#!/bin/bash
set -x
set -o errexit

#https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-examples.html
# 这几个例子很有特点
#1
#curl -XPOST "localhost:9200/_transform/_preview?pretty" -H 'Content-Type: application/json' -d'
curl -XPUT "localhost:9200/_transform/sample_ecommerce_orders_by_customer?pretty" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "kibana_sample_data_ecommerce"
  },
  "dest" : { 
    "index" : "sample_ecommerce_orders_by_customer"
  },
  "pivot": {
    "group_by": { 
      "user": { "terms": { "field": "user" }},
      "customer_id": { "terms": { "field": "customer_id" }}
    },
    "aggregations": {
      "order_count": { "value_count": { "field": "order_id" }},
      "total_order_amt": { "sum": { "field": "taxful_total_price" }},
      "avg_amt_per_order": { "avg": { "field": "taxful_total_price" }},
      "avg_unique_products_per_order": { "avg": { "field": "total_unique_products" }},
      "total_unique_products": { "cardinality": { "field": "products.product_id" }}
    }
  }
}
'

# 2
#curl -X POST "localhost:9200/_transform/_preview?pretty" -H 'Content-Type: application/json' -d'
curl -XPUT "localhost:9200/_transform/sample_flight_delays_by_carrier?pretty" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "kibana_sample_data_flights",
    "query": { 
      "bool": {
        "filter": [
          { "term":  { "Cancelled": false } }
        ]
      }
    }
  },
  "dest" : { 
    "index" : "sample_flight_delays_by_carrier"
  },
  "pivot": {
    "group_by": { 
      "carrier": { "terms": { "field": "Carrier" }}
    },
    "aggregations": {
      "flights_count": { "value_count": { "field": "FlightNum" }},
      "delay_mins_total": { "sum": { "field": "FlightDelayMin" }},
      "flight_mins_total": { "sum": { "field": "FlightTimeMin" }},
      "delay_time_percentage": { 
        "bucket_script": {
          "buckets_path": {
            "delay_time": "delay_mins_total.value",
            "flight_time": "flight_mins_total.value"
          },
          "script": "(params.delay_time / params.flight_time) * 100"
        }
      }
    }
  }
}
'

# 3
# 创建transform
curl -X PUT "localhost:9200/_transform/suspicious_client_ips?pretty" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "kibana_sample_data_logs"
  },
  "dest" : { 
    "index" : "sample_weblogs_by_clientip"
  },
  "sync" : { 
    "time": {
      "field": "timestamp",
      "delay": "6000s"
    }
  },
  "pivot": {
    "group_by": {  
      "clientip": { "terms": { "field": "clientip" } }
      },
    "aggregations": {
      "url_dc": { "cardinality": { "field": "url.keyword" }},
      "bytes_sum": { "sum": { "field": "bytes" }},
      "geo.src_dc": { "cardinality": { "field": "geo.src" }},
      "agent_dc": { "cardinality": { "field": "agent.keyword" }},
      "geo.dest_dc": { "cardinality": { "field": "geo.dest" }},
      "responses.total": { "value_count": { "field": "timestamp" }},
      "success" : { 
         "filter": {
            "term": { "response" : "200"}}
        },
      "error404" : {
         "filter": {
            "term": { "response" : "404"}}
        },
      "error503" : {
         "filter": {
            "term": { "response" : "503"}}
        },
      "timestamp.min": { "min": { "field": "timestamp" }},
      "timestamp.max": { "max": { "field": "timestamp" }},
      "timestamp.duration_ms": { 
        "bucket_script": {
          "buckets_path": {
            "min_time": "timestamp.min.value",
            "max_time": "timestamp.max.value"
          },
          "script": "(params.max_time - params.min_time)"
        }
      }
    }
  }
}
'
#启动transform 建立新索引
curl -XPOST "localhost:9200/_transform/suspicious_client_ips/_start?pretty"
#新索引上执行搜索
curl -XGET "localhost:9200/sample_weblogs_by_clientip/_search?pretty"
#删这个transform索引和转换...
:<<EOF
curl -XDELETE "localhost:9200/sample_weblogs_by_clientip"
curl -XPOST "localhost:9200/_transform/suspicious_client_ips/_stop?pretty"
curl -XDELETE "localhost:9200/_transform/suspicious_client_ips"
EOF

# xpack minitoring监控
curl "http://localhost:9200/_template/.monitoring-*?pretty"